Trove Managed Instances

The goal here is to prevent user's from compromising a VM Instance which Trove is managing (i.e. Guest Instance). There currently is a simple lock mechanism in Nova which once enable prevents modifications to the Instance through the Nova API. Trove will act as an Admin for the Nova VM and will place a lock on the instance preventing changes from happening outside of it's narrower-scoped API. The lock will be temporarily removed during actions in which Trove needs delegate to Nova for changes to the VM.